Last week, with support from Attorney General Xavier Becerra, California Senator Jackson introduced Senate Bill 561 to amend the California Consumer Privacy Act of 2018 (CCPA) by expanding a consumer’s private right of action to reach any consumer whose rights under the CCPA are violated.

If signed into law, these changes add significant teeth to the already-onerous statute.

SB 561 allows any consumer who claims their rights are violated to institute a civil action seeking damages between $100-750 per incident (or actual damages) as well as injunctive or declaratory relief.

SB 561 eliminates the Attorney General’s requirement to provide 30 day notice prior to taking action against a business (note that, based on the plain language of the amendment currently published, consumers are still obligated to provide a business with 30 days notice and an opportunity to cure prior to initiating an action).

SB 561 also eliminates the opportunity for businesses or third parties to seek specific opinions from the Attorney General. Instead, the amendment provides that the Attorney General may publish general guidance on how to comply.

Given that SB 561 creates serious exposure to civil liability, businesses (both those clearly covered and those who provide services to covered businesses) should continue to pay careful attention to this new statute, the California legislature’s movements, and the Attorney General’s rulemaking announcements.